# CVE-2026-124502: yungifez Skuul missing authorization in graduation reset

Source: https://junglewise.ai/threats/cve-2026-124502-a-security-vulnerability-has-been-detected-in-yungifez-skuul  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-124502 · Severity: medium · CVSS 4.3 · Published 2026-11-09

Skuul is a self-hosted school management system used by educational institutions to manage student records, graduations, and promotions. An authenticated non-admin user—such as a teacher—can reset a student's graduation status by exploiting a missing authorization check, effectively undoing an admin-only action. This allows any school staff member to manipulate student academic records without proper permission.

Technologies: [Yungifez Skuul](https://junglewise.ai/threats/technologies/skuul). Vendors: [Yungifez](https://junglewise.ai/threats/vendors/yungifez).

## Quick answers

**Is CVE-2026-124502 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-124502 being exploited in the wild.

**How severe is CVE-2026-124502?** Medium severity, with a CVSS score of 4.3, published 9 November 2026.

**Which products and versions are affected?** Yungifez Skuul up to 2.6.3.

**Is there a fix for CVE-2026-124502?** Yes: fixed in 3.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-124502 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-124502?** Check whether you run Yungifez Skuul at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.0.0

## Technical details

A broken access control vulnerability (CWE-862 / CWE-639) in the GraduationController::resetGraduation endpoint fails to invoke the existing GraduationPolicy::resetGraduation() authorization check. Any authenticated school member can call DELETE /dashboard/students/graduations/{student}/reset to reset a student's graduation status; the code only verifies the target is a student, not that the caller has the "reset graduation" permission (admin-only). A related PromotionController::resetPromotion endpoint also permits cross-school IDOR by not validating the target promotion belongs to the caller's school.

## Affected products

- yungifez Skuul up to 2.6.3

## Timeline

- 2026-10-14: disclosed: Vulnerability details published on GitHub gist
- 2026-09-27: patched: Fix commit b42f2c80a8e5e01ca6e607bbd97f137ede368ac9 merged
- 2026-11-09: advisory

## References

- [https://gist.github.com/mrvirus2006/94d6e1ed1d6cd9ddf6412c734a76243d](https://gist.github.com/mrvirus2006/94d6e1ed1d6cd9ddf6412c734a76243d)
- [https://github.com/yungifez/skuul/commit/b42f2c80a8e5e01ca6e607bbd97f137ede368ac9](https://github.com/yungifez/skuul/commit/b42f2c80a8e5e01ca6e607bbd97f137ede368ac9)

## Related threats

- [Skuul School Management System broken object-level authorization in result checker](https://junglewise.ai/threats/cve-2026-117028-skuul-school-management-system-through-version-2-6-5-is)
- [yungifez Skuul School Management System sensitive data exposure in image uploads](https://junglewise.ai/threats/cve-2025-13785-yungifez-skuul-school-management-system-sensitive-data-exposure)
- [yungifez Skuul School Management System stored XSS in SVG handler](https://junglewise.ai/threats/cve-2025-13784-yungifez-skuul-school-management-system-stored-xss-in-svg-handler)
- [Skuul School Management System has an Insecure Direct Object Reference (IDOR) Vulnerability in View Fee Invoice](https://junglewise.ai/threats/cve-2025-12918-skuul-school-management-system-has-an-insecure-direct-object)